Citi sends unrequested credit cards

— -- Citi and Macy's describe the new cards as a way to "replace" inactive Macy's accounts. But the new Citibank MasterCards aren't Macy's branded; they can be used anywhere MasterCard is accepted. Macy's cards can be used only in-store.

Consumer advocates worry that automatically sending cards to consumers — rather than doing so only if they request the cards — could expose consumers to information-stealing scamsters.

"In my view, it's a privacy violation and a customer violation," says Mari Frank, author of Safeguard Your Identity. "Privacy builds trust. Lack of privacy destroys trust."

Samuel Wang, a Citi spokesman, says customers were notified about the cards in advance and must activate them to use them. Wang adds that even in case of fraud, customers wouldn't be liable for the charges.

Wang wouldn't say how many of the millions who received the cards have activated them. He says only that a "favorable" number had, indicating the product's "value."

But advocates question whether the new cards violate a federal law that says banks can't issue credit cards unless customers request them or they're meant to replace existing cards.

"It's of questionable legality," says Chi Chi Wu, staff attorney at the National Consumer Law Center. At the least, "it certainly violates the spirit of why the prohibition against unsolicited cards was enacted."

Citi and Macy's say they don't think they're violating the law. Federal regulators say they haven't seen the card materials and can't comment.

Robin Gardner, 43, of Manassas, Va., says she was "flabbergasted" this week when she received a new Citi MasterCard she hadn't applied for. She closed the account.